diff --git a/backoffice.yaml b/backoffice.yaml
index 0ea4a4a..51913b1 100644
--- a/backoffice.yaml
+++ b/backoffice.yaml
@@ -12,6 +12,7 @@
 
   tasks:
     - import_tasks: tasks/apt-update.yaml
+    - import_tasks: tasks/apache.yaml
     - import_tasks: tasks/systemd.yaml
     - import_tasks: tasks/prometheus.yaml
     - import_tasks: tasks/uwsgi.yaml
@@ -23,6 +24,16 @@
       systemd:
         daemon_reload: yes
 
+    - name: apache is restarted
+      service:
+        name: apache2
+        state: restarted
+
+    - name: apache is reloaded
+      service:
+        name: apache2
+        state: reloaded
+
     - name: prometheus is restarted
       service:
         name: prometheus
diff --git a/tasks/apache.yaml b/tasks/apache.yaml
new file mode 100644
index 0000000..1238f5b
--- /dev/null
+++ b/tasks/apache.yaml
@@ -0,0 +1,28 @@
+---
+- name: switchaai apt-source package is installed
+  apt:
+    deb: https://pkg.switch.ch/switchaai/ubuntu/dists/bionic/main/binary-all/misc/switchaai-apt-source_1.0.0ubuntu1_all.deb
+  register: switchaai_source_pkg
+
+- name: apt cache is up-to-date after new source installed
+  apt:
+    update_cache: true
+  when: switchaai_source_pkg.changed
+
+- name: apache is installed
+  apt:
+    package:
+      - apache2
+      - libapache2-mod-proxy-uwsgi
+      - libapache2-mod-shib
+      - libapache2-mod-wsgi-py3
+      - python3-certbot-apache
+
+- name: apache is enabled
+  service:
+    name: apache2
+    enabled: yes
+    state: started
+
+# XXX TODO: merge backoffice-apache2.git and backoffice-shibboleth.git into
+# this repo and manage their installation, etc.